Privacy Policy
This policy explains how Appray ai LTD (“we”), registered in Rwanda under number 155671681, Gasabo, Kigali, Rwanda, handles personal data in connection with A3malak (the “Service”) and this website.
1. Our two roles
| Data | Our role |
|---|---|
| Your account: staff names, emails, login and security data, billing details, how you use the Service | Controller: we decide how this data is used, as described in this policy. |
| Your customers’ data: their WhatsApp messages, names, phone numbers, addresses and orders that your business handles in the Service | Processor: we process it only on your instructions under our Data Processing Agreement. Your business is the controller and is responsible for informing its customers and having a lawful basis. |
WhatsApp Business Platform data
The Service connects to the WhatsApp Business Platform (Cloud API) operated by Meta Platforms. When a business connects its WhatsApp number and uses the Service, we process:
- Messages sent and received on the business’s WhatsApp number: text, media (images, voice notes, documents, locations), message templates, delivery and read receipts, and timestamps.
- Contacts: the WhatsApp profile name and phone number (WhatsApp ID) of each person who messages the business, and, if the business chooses to keep using the WhatsApp Business app alongside the Service, contacts and recent chat history the business asks Meta to sync.
- Business account data: the WhatsApp Business Account and phone number ids, display name, quality rating, messaging limit, template status, and the access token and app-scoped Facebook user id from Meta Embedded Signup (the sign-in with Facebook used to connect the number). We do not receive the Facebook profile, friends or posts of the person who connects the number.
We use this data only to provide the Service to the business (show conversations in its inbox, send its replies and templates, run its orders and payment links, and show its number’s health). We do not use WhatsApp data for advertising, sell it, or share it with other businesses. Meta receives and processes the messages as provider of WhatsApp under its own terms and privacy policy (see section 4).
2. Data we collect as controller
- Account and contact details: name, business name, email, phone, role.
- Security data: login records, devices, IP addresses, two-factor authentication settings.
- Billing data: plan, invoices and payment status. Card details go from your browser to Moyasar, which stores them as a secure token; we keep only the token and the card's brand and last four digits. To allow one free trial per business we keep one-way hashes (not the values) of the card's brand, last four digits and expiry, the CR number and the WhatsApp number used for a trial.
- Usage data: features used, errors and performance information, used to run and improve the Service.
- Communications: messages you send to our support.
This website does not use advertising trackers or third-party analytics cookies.
In the merchant app, when you choose “Stay signed in on this device”, we keep a short cached view of recent lists (names and short previews only) on that device for speed. It expires after 12 hours and is deleted when you sign out.
3. How we use it
- To provide the Service and your account (performance of our contract with you).
- To secure the Service, prevent abuse and fraud, and keep audit logs (legitimate interests and legal obligations).
- To bill you, issue ZATCA e-invoices and meet tax and accounting obligations (contract and legal obligations).
- To send service and security notices, and, with your consent, product updates you can opt out of at any time.
4. Who we share data with
We use these sub-processors and partners; we share only what each needs:
- Meta Platforms (WhatsApp Business Platform): an independent third party and provider of WhatsApp, through which every message to and from the business’s number passes. Meta processes message content, phone numbers and business account data under its own WhatsApp Business terms and privacy policy; it acts as a processor for the business’s Cloud API messages under Meta’s terms.
- Moyasar (Saudi Arabia): our licensed payment provider, for card and mada payments and refunds.
- Cloud hosting provider: servers, databases, storage and backups.
- AI model providers: only if you turn on AI features, and only minimized, masked conversation context. The AI model provider is Anthropic, PBC, in the United States of America, so AI requests are processed outside the Kingdom of Saudi Arabia. Before any text is sent, personal details such as names and phone numbers are replaced with placeholders, and they are filled back in on our servers. Merchants can switch on an in-Kingdom-only AI setting, but no in-Kingdom AI model is available yet, so with that setting on, AI features stop working. Prompts and outputs are kept for 30 days and are never used to train models without your explicit consent.
- Email provider: for account and notification messages. SMS provider: only for sign-in codes, when you choose them as a fallback.
We publish an up-to-date list of sub-processors and notify customers of changes. We do not sell personal data.
5. International transfers
Some providers above, including Meta and the AI model provider (Anthropic, in the United States), process data outside the Kingdom of Saudi Arabia. Where this happens we rely on appropriate safeguards required by applicable law, including the Saudi Personal Data Protection Law (PDPL) for data relating to Saudi Arabia and Rwanda’s Law No. 058/2021 on the protection of personal data and privacy.
6. Retention
- Account data: for as long as your account exists, then deleted after a grace period, except data we must keep by law (for example, billing records).
- Your customers’ conversations and media: by default 3 years (configurable by you from 1 to 5 years), then deleted.
- Audit logs: at least 2 years. Backups: rolling 35 days.
- WhatsApp access tokens: until the number is disconnected, the business account closes, or the person who connected it removes our app in Facebook, then deleted immediately.
How merchants, their customers and people who connected WhatsApp through Facebook can have data deleted, and the timelines, are set out on our Data Deletion page. When a person removes our app in Facebook, Meta sends us a deletion request; we then disconnect the numbers they connected and delete the stored tokens, and give them a confirmation code and a status page.
7. Security
We isolate each business’s data, encrypt data in transit and sensitive fields at rest, enforce two-factor authentication for privileged roles, keep audit logs and limit our staff’s access. Support staff can see your conversations only if you grant time-limited access.
8. Your rights
You can ask to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent, by emailing [email protected]. We respond within 30 days. If you are a customer of a business that uses the Service, please contact that business first; we help them handle your request. You can also complain to your data protection authority (for example, SDAIA in Saudi Arabia or the National Cyber Security Authority in Rwanda). Step-by-step deletion instructions: Data Deletion.
9. Breaches
If a personal data breach affects your data, we notify you without undue delay and notify authorities within the time required by law.
10. Changes and contact
We will post changes to this policy here and notify you of material changes. Contact: [email protected], Appray ai LTD, Gasabo, Kigali, Rwanda.